Mayne0213
3366a6b5b8
- and CNPG infrastructure components Add three critical infrastructure components via GitOps: - Velero: Backup and disaster recovery solution - Configured with Minio S3 backend - Daily full cluster backups (30-day retention) - Hourly backups for critical namespaces (7-day retention) - Credentials managed via External Secrets from Vault - Falco: Runtime security monitoring - eBPF-based threat detection - Custom rules for container security - Falcosidekick for alert forwarding - Prometheus metrics enabled - CNPG (CloudNativePG): PostgreSQL operator - Kubernetes-native PostgreSQL management - Automated failover and backups - Will replace Bitnami PostgreSQL All components follow existing GitOps patterns: - Helm charts deployed via ArgoCD - Values managed in Git - Automated sync with selfHeal enabled
79 lines
1.3 KiB
YAML
79 lines
1.3 KiB
YAML
# CloudNativePG Operator Helm Values
|
|
# Chart: https://github.com/cloudnative-pg/charts
|
|
|
|
# Operator image
|
|
image:
|
|
repository: ghcr.io/cloudnative-pg/cloudnative-pg
|
|
tag: 1.25.1
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Replica count for operator
|
|
replicaCount: 1
|
|
|
|
# Resource requests for operator
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
# RBAC
|
|
rbac:
|
|
create: true
|
|
|
|
# Service Account
|
|
serviceAccount:
|
|
create: true
|
|
name: cnpg-operator
|
|
|
|
# Monitoring
|
|
monitoring:
|
|
# Enable Prometheus PodMonitor
|
|
podMonitorEnabled: true
|
|
|
|
# Webhook configuration
|
|
webhook:
|
|
port: 9443
|
|
mutating:
|
|
create: true
|
|
validating:
|
|
create: true
|
|
|
|
# Operator configuration
|
|
config:
|
|
# Data checksums for PostgreSQL
|
|
data:
|
|
INHERITED_ANNOTATIONS: "cert-manager.io/*, argocd.argoproj.io/*"
|
|
INHERITED_LABELS: "app.kubernetes.io/*"
|
|
|
|
# Monitoring queries interval
|
|
MONITORING_QUERIES_CONFIGMAP: ""
|
|
MONITORING_QUERIES_SECRET: ""
|
|
|
|
# CRD configuration
|
|
crds:
|
|
create: true
|
|
|
|
# Node selector
|
|
nodeSelector: {}
|
|
|
|
# Tolerations
|
|
tolerations: []
|
|
|
|
# Affinity
|
|
affinity: {}
|
|
|
|
# Security context
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|